Custom certificate subjects

[verement]

step seems to be opinionated that certificate subjects can only be a common name, DNS name, or IP address.

I have a need to create certificates with subjects that are full X.500-style DNs. Is there a way to do this with step?

[tashian]

Yes, you can do this with certificate templates. For example:

{
    "subject": {
        "organization": {{ toJson .Organization }},
        "commonName": {{ toJson .Subject.CommonName }},
        "organizationalUnit": {{ toJson .OrganizationalUnit }}
    },
    "sans": {{ toJson .SANs }},
    "keyUsage": ["digitalSignature"],
    "extKeyUsage": ["clientAuth", "serverAuth"]
}

You can then configure fixed values in the provisioner configuration:

        "options": {
                "x509": {
                        "templateFile": "templates/x509/server.tpl",
                        "templateData": {
                                "Organization": "Smallstep",
                                "OrganizationalUnit": "Engineering"
                        }
                }
        }

Alternatively, if you need user-supplied values, you can use the --set or --set-file parameters on step ca certificate to populate the template. In that case, the variable names in the template must be prefixed with .Insecure.User. See our template docs for more details.

[maraino]

You can also use global DNs (country, organization, ...), for all provisioners adding a block like this inside "authority"

{
   "...":"...",
   "authority": {
      "template": {
         "country": "US",
         "organization": "Smallstep",
         "organizationalUnit": "Smallstep Eng",
         "locality": "San Francisco",
         "province": "California",
         "streetAddress": "1 The Street St"
      },
      "...":"...",
   },
   "...":"...",
}